Alert
There has been a spate of fraudulent document sharing emails circulating within the legal community that look like they are legitimate emails from other law firms.
What is happening
They ask the receiver (you) to access documents by clicking on a link to a document sharing platform such as Skyfish or Dropbox.
These emails won’t necessarily be caught by anti-spam filters because they are coming from legitimate law firm email accounts that have been compromised and accessed by cyber criminals.
If you click on the link you will be asked to put in your email credentials – username and password. By doing this you will be giving the cyber-criminals access to your email account. Access to your email account allows the criminals to monitor your correspondence silently and look for cyber fraud opportunities.
What to do if you receive an email asking to share files
- Don’t just click on the link– even if it looks legitimate as it may be from a compromised account.
- Phone the sender to confirm they have sent the email to you and what information the file sharing platform actually needs from you before you decide whether to open the link in the email.
- If the purported sender knows nothing about the email they should be advised to report it to their IT security managers immediately.
- The recipient should also report the email to their IT security managers.
If you have already opened the link and entered your email account credentials, your email account has probably been compromised. You need to immediately investigate the compromise and take steps to contain the risk of a data breach. Implement your cyber security incident response plan.
Notify LPLC of any compromise to your IT system as there may be a risk of claims arising and advice and steps we can help you with.
How to safeguard your system
Enable multifactor authentication (MFA) immediately as a safeguard against future attempts. Even if the cyber-criminals now have your username and password they won’t be able to log in to your email account from another device if you have MFA in place.
For more detailed information about cyber hygiene practices and how to reduce your cyber risk see our new Cyber Security Guide for Lawyers and our other cyber resources.
